Executive brief
The Linux kernel's NFC (Near Field Communication) subsystem contains a bug where uninitialized memory in RF (radio frequency) notification handlers can leak into kernel data structures and be exposed to user space. This could allow a system with NFC hardware to unintentionally disclose sensitive kernel memory contents to local applications querying NFC target information.
Technical details
The vulnerability is an uninitialized value (use of uninitialized variables) in the NCI protocol layer's RF discovery and interface activation notification handlers. Specifically, nci_rf_discover_ntf_packet() and nci_rf_intf_activated_ntf_packet() declare on-stack structs that are never initialized. When RF technology-specific parameters have zero length, the rf_tech_specific_params union remains uninitialized. These uninitialized values are subsequently read by nci_add_new_protocol() and copied into ndev->targets, which is exposed to userspace via NFC_CMD_GET_TARGET. The fix initializes both notification structs to zero at declaration time. No special privileges or network access are required; the issue is triggered by processing legitimate NFC notifications on systems with NFC hardware/drivers.
Affected products
- Linux Linux kernel multiple versions prior to fixes in commit 8cbe06c1e699c0a165dae5093a2550e65f914818
Timeline
- 2026-09-04: disclosed: Published in NVD
- 2026-08-27: patched: Fix committed to kernel stable tree
- 2026-09-02: patched: Fix committed to additional stable branches